Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
Detects a self-extracting 7-Zip archive that exhibits characteristics of a downloader, specifically looking for the presence of '7-Zip' strings, WinINet API calls ('WinINet', 'InternetReadFile') for downloading, and 'CreateProcessW' for launching child processes. It also looks for the string 'AppData\Local\Programs', which could indicate an installation path. The rule targets executable files (MZ header).
Detects the use of curl.exe to download the Python embeddable zip file directly into the C:\Users\Public directory, indicative of NarwhalRAT staging.
Correlates the Komari C2 agent writing secondary executable payloads (.exe, .dll) to disk, indicating lateral tool transfer or stage progression.
This rule detects the download of a standalone Python build for Apple Darwin from astral-sh/python-build-standalone on GitHub using 'curl', followed by its extraction using 'tar'. This activity could indicate a developer setting up a specific Python environment or potentially a malicious actor introducing a custom Python interpreter.
Detects PowerShell downloading an archive and expanding it into a user-writable directory with mining-related filenames or parameters.
Detects a multi-stage attack pattern involving the creation of JavaScript or XML files in a specific public user directory, followed by their execution via wscript.exe or cscript.exe, and subsequently, the spawning of curl.exe by these script hosts to download additional content. This sequence is indicative of malware staging and execution, often used for initial access or further payload delivery.
Detects PowerShell downloading a packed loader DLL and writing it directly to the C:\Users\Public directory. This rule specifically looks for file creation events where the file path is within 'C:\Users\Public', the file name ends with '.dll', and the initiating process is 'powershell.exe'.
Correlates a PDF reader (Adobe, Foxit) executing a native network utility (cURL, certutil) to fetch a secondary payload, indicative of malicious PDF links or exploits.
This rule detects the loading of a machine learning model (e.g., Pickle, PyTorch, or Hugging Face model files) via Python, immediately followed by the creation of a Windows Executable (PE) or Shared Object (.so) file on disk by the same initiating process. This behavior is indicative of an embedded stage-2 loader within a malicious model file, often seen in backdoored Large Language Models (LLMs). The time correlation between the model loading and the file drop is set to 45 seconds to identify immediate post-load execution.
Detects the use of certutil.exe to download files from a remote URL using the -urlcache or -split flags. This behavior is a common Living-off-the-Land (LotL) technique used by adversaries to bypass security controls and download secondary payloads.
Detects a deceptive scheduled task named 'MicrosoftEdgeUpdate' executing PowerShell Net.WebClient download cradles. This rule specifically looks for the creation of a scheduled task using 'schtasks.exe' that includes 'MicrosoftEdgeUpdate' in its name and 'Net.WebClient' in its command line, indicating an attempt to download content using PowerShell's WebClient object, potentially for malicious purposes.
Correlates a downloaded remote support installer with execution of the same file on the endpoint shortly afterwards. This rule identifies instances where a known remote access tool installer (e.g., AnyDesk, Bomgar, BeyondTrust) is downloaded and then executed on the same device within a 15-minute window, which could indicate an attacker establishing remote access.
Detects the usage of curl and tar commands in rapid succession to download and extract files. This behavior is characteristic of EtherRAT's Node.js staging process, which bypasses pre-installed dependencies.
Detects unexpected outbound network connections from the ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe processes. Threat actors use WinGet DSC execution to establish reverse shells or download payloads. Network activity from these processes is highly unusual.
Detects the use of certutil.exe with command-line arguments indicative of downloading files from a URL or decoding/encoding data. This utility is often abused by adversaries for ingress tool transfer or obfuscation.
Detects the loader using the native Windows curl.exe to retrieve a ZIP archive containing the RMM components, bypassing PowerShell execution policies. This rule specifically looks for curl.exe executing with command-line arguments that indicate an output file ending in '.zip' and a URL, followed by a file creation event for a '.zip' file.
Detects a script constructing a URL or request path from hostname, username, machine GUID, or volume serial information before downloading a second stage. This behavior is associated with the InstallFix malware.
This rule detects PowerShell processes attempting to retrieve or execute remote .rtf resources via web requests. It specifically looks for `powershell.exe` or `pwsh.exe` in the process path combined with command-line arguments indicating `Invoke-WebRequest`, `iwr`, `DownloadString`, `Invoke-Expression`, or `iex` targeting a URL ending in `.rtf`.
Targets API request content containing shell separators together with command interpreters or transfer utilities. The UDM rule retains principal and target context for correlation.
Detects the staging of operational executables (like FRP, proxy tools, secrets dumpers, or scanners) within web application administration directories or repository checkouts. This activity is suspicious as these directories should primarily contain source code or web application files, not executable tools. The detection specifically looks for these executables being created or modified by processes commonly associated with code repositories or command-line operations (git, powershell, curl, cmd).
This rule detects PowerShell processes attempting to retrieve or execute content from a remote RTF (Rich Text Format) resource. It specifically looks for PowerShell commands like 'Invoke-WebRequest', 'iwr', 'DownloadString', 'Invoke-Expression', or 'iex' that are directed towards a URL ending with '.rtf'. This behavior is often associated with malicious activity where RTF files are used as a delivery mechanism for scripts.
Page 77 of 121